What is CVE-2022-0024?

CVE-2022-0024 is a vulnerability in Palo Alto Networks PAN-OS software that allows an authenticated network-based administrator to upload a specially crafted configuration and potentially execute arbitrary code with root privileges.

How does CVE-2022-0024 affect Palo Alto Networks PAN-OS software?

CVE-2022-0024 affects Palo Alto Networks PAN-OS software versions 8.1.0 to 8.1.23, 9.0.0 to 9.0.16, 9.1.0 to 9.1.13, 10.0.0 to 10.0.10, and 10.1.0 to 10.1.5.

What is the severity of CVE-2022-0024?

CVE-2022-0024 has a severity rating of 7.2 (critical).

How can an attacker exploit CVE-2022-0024?

An attacker with authenticated network access can exploit CVE-2022-0024 by uploading a specially created configuration to disrupt system processes and potentially execute arbitrary code with root privileges.

Is there a fix available for CVE-2022-0024?

Yes, Palo Alto Networks has released patches to address the vulnerability. It is recommended to update to the latest version of PAN-OS software.

Vulnerability/
CVE-2022-0024

critical

CWE

138

11/5/2022

20/5/2022

CVE-2022-0024

First published: Wed May 11 2022(Updated: )

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committed on both hardware and virtual firewalls. This issue does not impact Panorama appliances or Prisma Access customers. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.23; PAN-OS 9.0 versions earlier than PAN-OS 9.0.16; PAN-OS 9.1 versions earlier than PAN-OS 9.1.13; PAN-OS 10.0 versions earlier than PAN-OS 10.0.10; PAN-OS 10.1 versions earlier than PAN-OS 10.1.5.

Credit: psirt@paloaltonetworks.com

Affected Software	Affected Version	How to fix
Paloaltonetworks Pan-os	>=8.1.0<8.1.23
Paloaltonetworks Pan-os	>=9.0.0<9.0.16
Paloaltonetworks Pan-os	>=9.1.0<9.1.13
Paloaltonetworks Pan-os	>=10.0.0<10.0.10
Paloaltonetworks Pan-os	>=10.1.0<10.1.5

Never miss a vulnerability like this again

Reference Links

https://security.paloaltonetworks.com/CVE-2022-0024

Frequently Asked Questions

What is CVE-2022-0024?
CVE-2022-0024 is a vulnerability in Palo Alto Networks PAN-OS software that allows an authenticated network-based administrator to upload a specially crafted configuration and potentially execute arbitrary code with root privileges.
How does CVE-2022-0024 affect Palo Alto Networks PAN-OS software?
CVE-2022-0024 affects Palo Alto Networks PAN-OS software versions 8.1.0 to 8.1.23, 9.0.0 to 9.0.16, 9.1.0 to 9.1.13, 10.0.0 to 10.0.10, and 10.1.0 to 10.1.5.
What is the severity of CVE-2022-0024?
CVE-2022-0024 has a severity rating of 7.2 (critical).
How can an attacker exploit CVE-2022-0024?
An attacker with authenticated network access can exploit CVE-2022-0024 by uploading a specially created configuration to disrupt system processes and potentially execute arbitrary code with root privileges.
Is there a fix available for CVE-2022-0024?
Yes, Palo Alto Networks has released patches to address the vulnerability. It is recommended to update to the latest version of PAN-OS software.

collector/nvd-index
vendor/paloaltonetworks
canonical/paloaltonetworks pan-os
version/paloaltonetworks pan-os/8.1.0
version/paloaltonetworks pan-os/9.0.0
version/paloaltonetworks pan-os/9.1.0
version/paloaltonetworks pan-os/10.0.0
version/paloaltonetworks pan-os/10.1.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.